SteganographyHidden Investigations CTF 2026
Whispers in the Margin
A DOCX hides a message in whitespace-only paragraphs (spaces and tabs as 7-bit ASCII). That decoded text is the steghide passphrase for an accompanying JPEG, which contains the flag.
What this one teaches
- Whitespace-only paragraphs in a DOCX can encode binary data — tabs as 1, spaces as 0, last 7 characters per paragraph as 7-bit ASCII.
- A message that looks like a decoy ('haha! u got me, now what?') can still be functional — here it is the steghide passphrase.
Task description
Sometimes the most crucial details are right in front of you, hidden where no one bothers to look. Inspect the provided documents closely—what appears empty might hold the key to unravelling the final secret.
The challenge provides a directory containing a .docx and a .jpg.
Whitespace decoding
Unzip the DOCX and read word/document.xml. After the visible text there are about 25 paragraphs made only of spaces and tabs (the “empty” area), each followed by a paragraph containing a lone tab.
Each space/tab paragraph encodes one ASCII character. Take the last 7 characters, with tab = 1 and space = 0, and read them as 7-bit ASCII (the leading spaces are padding). Example: \t\t \t → 1101000 → h.
Decoded text: haha! u got me, now what?
Steghide extraction
The text looks like a decoy, but it is the steghide passphrase for chall.jpg. The JPEG has no trailing data and no EXIF clues. Extract the hidden data:
steghide extract -sf chall.jpg -p "haha! u got me, now what?" -xf out.bin -fThe output is the flag.
The flagReveal
hiCTF{573g4n0gr4phy_!5_fun}This CTF was possibly solved, and the writeup most likely written by an LLM. Apologies for inconsistencies.